@Override
  public Response createFromYaml(String yaml) {
    // First of all, see if it's a URL
    URI uri;
    try {
      uri = new URI(yaml);
    } catch (URISyntaxException e) {
      // It's not a URI then...
      uri = null;
    }
    if (uri != null) {
      log.debug("Create app called with URI; retrieving contents: {}", uri);
      yaml = ResourceUtils.create(mgmt()).getResourceAsString(uri.toString());
    }

    log.debug("Creating app from yaml:\n{}", yaml);
    EntitySpec<? extends Application> spec = createEntitySpecForApplication(yaml);

    if (!Entitlements.isEntitled(
        mgmt().getEntitlementManager(), Entitlements.DEPLOY_APPLICATION, spec)) {
      throw WebResourceUtils.unauthorized(
          "User '%s' is not authorized to start application %s",
          Entitlements.getEntitlementContext().user(), yaml);
    }

    return launch(yaml, spec);
  }
  private Response launch(String yaml, EntitySpec<? extends Application> spec) {
    try {
      Application app = EntityManagementUtils.createUnstarted(mgmt(), spec);
      CreationResult<Application, Void> result = EntityManagementUtils.start(app);

      boolean isEntitled =
          Entitlements.isEntitled(
              mgmt().getEntitlementManager(),
              Entitlements.INVOKE_EFFECTOR,
              EntityAndItem.of(app, StringAndArgument.of(Startable.START.getName(), null)));

      if (!isEntitled) {
        throw WebResourceUtils.unauthorized(
            "User '%s' is not authorized to start application %s",
            Entitlements.getEntitlementContext().user(), spec.getType());
      }

      log.info("Launched from YAML: " + yaml + " -> " + app + " (" + result.task() + ")");

      URI ref = URI.create(app.getApplicationId());
      ResponseBuilder response = created(ref);
      if (result.task() != null) response.entity(TaskTransformer.FROM_TASK.apply(result.task()));
      return response.build();
    } catch (ConstraintViolationException e) {
      throw new UserFacingException(e);
    } catch (Exception e) {
      throw Exceptions.propagate(e);
    }
  }
 private ArrayNode entitiesIdAsArray(Iterable<? extends Entity> entities) {
   ArrayNode node = mapper().createArrayNode();
   for (Entity entity : entities) {
     if (Entitlements.isEntitled(
         mgmt().getEntitlementManager(), Entitlements.SEE_ENTITY, entity)) {
       node.add(entity.getId());
     }
   }
   return node;
 }
 private ArrayNode childEntitiesRecursiveAsArray(Entity entity) {
   ArrayNode node = mapper().createArrayNode();
   for (Entity e : entity.getChildren()) {
     if (Entitlements.isEntitled(
         mgmt().getEntitlementManager(), Entitlements.SEE_ENTITY, entity)) {
       node.add(recursiveTreeFromEntity(e));
     }
   }
   return node;
 }
 private ArrayNode entitiesIdAndNameAsArray(Collection<? extends Entity> entities) {
   ArrayNode node = mapper().createArrayNode();
   for (Entity entity : entities) {
     if (Entitlements.isEntitled(
         mgmt().getEntitlementManager(), Entitlements.SEE_ENTITY, entity)) {
       ObjectNode holder = mapper().createObjectNode();
       holder.put("id", entity.getId());
       holder.put("name", entity.getDisplayName());
       node.add(holder);
     }
   }
   return node;
 }
 @Override
 public Response delete(String application) {
   Application app = brooklyn().getApplication(application);
   if (!Entitlements.isEntitled(
       mgmt().getEntitlementManager(),
       Entitlements.INVOKE_EFFECTOR,
       Entitlements.EntityAndItem.of(
           app, StringAndArgument.of(Entitlements.LifecycleEffectors.DELETE, null)))) {
     throw WebResourceUtils.unauthorized(
         "User '%s' is not authorized to delete application %s",
         Entitlements.getEntitlementContext().user(), app);
   }
   Task<?> t = brooklyn().destroy(app);
   TaskSummary ts = TaskTransformer.FROM_TASK.apply(t);
   return status(ACCEPTED).entity(ts).build();
 }
  @Override
  public JsonNode fetch(String entityIds) {
    Map<String, JsonNode> jsonEntitiesById = MutableMap.of();
    for (Application application : mgmt().getApplications())
      jsonEntitiesById.put(application.getId(), fromEntity(application));
    if (entityIds != null) {
      for (String entityId : entityIds.split(",")) {
        Entity entity = mgmt().getEntityManager().getEntity(entityId.trim());
        while (entity != null && entity.getParent() != null) {
          if (Entitlements.isEntitled(
              mgmt().getEntitlementManager(), Entitlements.SEE_ENTITY, entity)) {
            jsonEntitiesById.put(entity.getId(), fromEntity(entity));
          }
          entity = entity.getParent();
        }
      }
    }

    ArrayNode result = mapper().createArrayNode();
    for (JsonNode n : jsonEntitiesById.values()) result.add(n);
    return result;
  }
  /** @deprecated since 0.7.0 see #create */
  @Deprecated
  protected Response createFromAppSpec(ApplicationSpec applicationSpec) {
    if (!Entitlements.isEntitled(
        mgmt().getEntitlementManager(), Entitlements.DEPLOY_APPLICATION, applicationSpec)) {
      throw WebResourceUtils.unauthorized(
          "User '%s' is not authorized to start application %s",
          Entitlements.getEntitlementContext().user(), applicationSpec);
    }

    checkApplicationTypesAreValid(applicationSpec);
    checkLocationsAreValid(applicationSpec);
    // TODO duplicate prevention
    List<Location> locations = brooklyn().getLocations(applicationSpec);
    Application app = brooklyn().create(applicationSpec);
    Task<?> t = brooklyn().start(app, locations);
    TaskSummary ts = TaskTransformer.FROM_TASK.apply(t);
    URI ref =
        uriInfo
            .getBaseUriBuilder()
            .path(ApplicationApi.class)
            .path(ApplicationApi.class, "get")
            .build(app.getApplicationId());
    return created(ref).entity(ts).build();
  }